Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-40809OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number.Maven · org.opencrx:opencrx-core-models
- CVE-2023-40810OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field.Maven · org.opencrx:opencrx-core-models
- CVE-2023-40812OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field.Maven · org.opencrx:opencrx-core-models
- CVE-2023-40813OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation.Maven · org.opencrx:opencrx-core-models
- CVE-2023-40814OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field.Maven · org.opencrx:opencrx-core-models
- CVE-2023-40815OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field.Maven · org.opencrx:opencrx-core-models
- CVE-2023-40816OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field.Maven · org.opencrx:opencrx-core-models
- CVE-2023-40817OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field.Maven · org.opencrx:opencrx-core-models
- CVE-2023-47797Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote aMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.96
- CVE-2023-47112Authenticated users can view job names and groups they do not have authorization to view in RundeckMaven · org.rundeck:rundeckapp · fixed in 4.17.3
- CVE-2023-48222Authenticated users can view or delete jobs they do not have authorization for in RundeckMaven · org.rundeck:rundeck · fixed in 4.17.3
- CVE-2023-40314Cross-site scripting in bootstrap.jspMaven · org.opennms:opennms-webapp · fixed in 32.0.5
- CVE-2023-6038Local File Inclusion in h2oai/h2o-3Maven · ai.h2o:h2o-core
- CVE-2023-26031Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systemsMaven · org.apache.hadoop:hadoop-yarn-project · fixed in 3.3.5
- CVE-2023-5720Quarkus: build env information disclosure via gradle pluginMaven · io.quarkus:quarkus-project
- CVE-2023-5245Using MLeap for loading a saved model (zip archive) can lead to path traversal/arbitrary file creation and possibly remote code execution.Maven · ml.combust.mleap:mleap-runtime_2.12 · fixed in 0.23.1
- CVE-2023-34062In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using aMaven · io.projectreactor.netty:reactor-netty-http · fixed in 1.1.13, 1.0.39
- CVE-2023-48087xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat.Maven · com.xuxueli:xxl-job-admin
- CVE-2023-48088xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage.Maven · com.xuxueli:xxl-job-admin
- CVE-2023-48089xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save.Maven · com.xuxueli:xxl-job-admin
- CVE-2023-4218XXE in eclipse.platform / Eclipse IDEMaven · org.eclipse.jdt:org.eclipse.jdt.ui, org.eclipse.platform:org.eclipse.core.runtime +6 · fixed in 3.30.0, 3.29.0, 3.31.0 and more
- CVE-2023-39913Apache UIMA Java SDK Core, Apache UIMA Java SDK CPE, Apache UIMA Java SDK Vinci adapter, Apache UIMA Java SDK tools: Potential untrusted code execution when deserializing certain binary CAS formatsMaven · org.apache.uima:uimaj · fixed in 3.5.0
- CVE-2023-4061Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actorMaven · org.wildfly.core:wildfly-controller · fixed in 22.0.0.Final
- CVE-2023-46243Code execution via the edit action in XWiki platformMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 15.2-rc-1, 14.10.6
- CVE-2023-46242Code injection in XWiki PlatformMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 14.10.7, 15.2-rc-1
- CVE-2023-46244Privilege escalation in Xwiki platformMaven · org.xwiki.platform:xwiki-platform-display-api · fixed in 14.10.7, 15.2-rc-1
- CVE-2023-46731Remote code execution through the section parameter in Administration as guest in XWiki PlatformMaven · org.xwiki.platform:xwiki-platform-administration, org.xwiki.platform:xwiki-platform-administration-ui · fixed in 14.10.14, 15.5.1
- CVE-2023-46732Reflected Cross-site scripting through revision parameter in content menu in XWiki PlatformMaven · org.xwiki.platform:xwiki-platform-flamingo-skin-resources · fixed in 14.10.14, 15.5.1
- CVE-2023-4043Parsson DoS when parsing numbers from untrusted sourcesMaven · org.eclipse.parsson:project · fixed in 1.1.4, 1.0.5
- CVE-2023-5763Glassfish remote code executionMaven · org.glassfish.main.orb:orb-connector · fixed in 7.0.0